一键转换为机关公文标准格式

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:08 AM UTC
• Version: 1.0.5

Overview

This skill is a straightforward Chinese official-document generator that creates a local DOCX file and does not show hidden data access, persistence, or deceptive behavior.

Install this only if you intend to generate Chinese GB/T 9704-2012 style official documents. Review any contact details or other personal information before producing or sharing the DOCX, and consider using a virtual environment plus hash-verified dependency installation for stricter supply-chain control.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: README.md:48

Finding

Dependency Installation Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: README.md:48
Vulnerability Type: Supply-chain integrity weakness
Risk Level: Low

Vulnerable Code:

bash

pip install python-docx==1.2.0

Technical Analysis

The documentation instructs users to install a third-party Python package directly with pip. Pinning the package to version 1.2.0 provides version stability, and the package name is consistent with the script's docx import. However, the command does not verify the package's cryptographic hash and implicitly trusts the package index configured in the user's environment.

If that index, a configured mirror, DNS resolution, or the associated package-distribution account is compromised, an altered package could be installed. Python package installation and subsequent imports can execute package-controlled code.

Attack Path

1. An attacker compromises or controls the Python package index or mirror configured for the target environment.
2. The attacker publishes or substitutes malicious package artifacts matching python-docx==1.2.0.
3. A user follows the documented installation command.
4. pip retrieves the unverified artifact from the compromised source.
5. Attacker-controlled code may execute during installation or when generate_docx.py imports the package.

This path requires prior control of, or influence over, the package distribution channel used by the victim.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running pip or the document-generation script. Potential effects include access to files readable by that user, alteration of generated documents, credential theft from the user context, and further compromise of the local environment. The issue does not independently provide elevated or administrative privileges.

Remediation

View remediation

Remediation Suggestions

1. Add a dependency lock file containing cryptographic hashes and require hash validation:

   bash

   pip install --require-hashes -r requirements.txt
   

2. Pin the exact package version and all transitive dependencies in that lock file.
3. Generate and review hashes from artifacts obtained through a trusted package repository.
4. Explicitly configure a trusted package index rather than inheriting an unknown system or user-level mirror.
5. Install dependencies inside a dedicated, least-privileged virtual environment.
6. Periodically review and update locked dependencies after checking their provenance and published security advisories.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file presents all user-facing instructions exclusively in Chinese and does not indicate that users may choose another language or that the skill is limited to a Chinese-only audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill title and description present the skill as a general-purpose official-document skill, but all formatting rules and examples are fixed to Chinese government document conventions and Chinese text output. Because the file does not explicitly frame this as a China-specific or Chinese-only skill with user opt-in, it can be read as forcing a specific language/locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring states the script generates official Chinese government documents based on a Chinese formatting standard, and later code/configuration uses only Chinese content and Chinese typography conventions. This imposes a specific language/locale behavior without offering the user any language selection or documenting it as an explicit opt-in regional tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The markdown documents collection and formatting of personal contact data such as names, phone numbers, and addresses, and shows that this data will be inserted into generated official documents. However, there is no warning that users should avoid including sensitive personal information unintentionally or verify that such data is appropriate for disclosure in the output document.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file contains natural-language guidance that is explicitly tied to Chinese government document standards, including Chinese fonts, Chinese date formats, and Chinese-language document structures. Because the instructions impose a specific language/locale throughout the skill content with no user opt-in or alternative locale handling, it matches the language/locale policy-violation category.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.